authorization_next 0.1.0

data/lib/authorization_next/publishare/object_roles_table.rb

@@ -0,0 +1,118 @@
+require File.dirname(__FILE__) + '/exceptions'
+require File.dirname(__FILE__) + '/identity'
+
+module AuthorizationNext
+  module ObjectRolesTable
+  
+    module UserExtensions
+      def self.included( recipient )
+        recipient.extend( ClassMethods )
+      end
+      
+      module ClassMethods
+        def acts_as_authorized_user
+          has_and_belongs_to_many :roles
+          attr_protected :role_ids
+          include AuthorizationNext::ObjectRolesTable::UserExtensions::InstanceMethods
+          include AuthorizationNext::Identity::UserExtensions::InstanceMethods   # Provides all kinds of dynamic sugar via method_missing
+        end
+      end
+      
+      module InstanceMethods
+        # If roles aren't explicitly defined in user class then check roles table
+        def has_role?( role_name, authorizable_obj = nil )
+          if authorizable_obj.nil?
+            self.roles.find_by_name( role_name ) ? true : false    # If we ask a general role question, return true if any role is defined.
+          else
+            role = get_role( role_name, authorizable_obj )
+            role ? self.roles.exists?( role.id ) : false
+          end
+        end
+        
+        def has_role( role_name, authorizable_obj = nil )
+          role = get_role( role_name, authorizable_obj )
+          if role.nil?
+            if authorizable_obj.is_a? Class
+              role = Role.create( :name => role_name, :authorizable_type => authorizable_obj.to_s )
+            elsif authorizable_obj
+              role = Role.create( :name => role_name, :authorizable => authorizable_obj )
+            else
+              role = Role.create( :name => role_name )
+            end
+          end
+          self.roles << role if role and not self.roles.exists?( role.id )
+        end
+        
+        def has_no_role( role_name, authorizable_obj = nil  )
+          role = get_role( role_name, authorizable_obj )
+          if role
+            self.roles.delete( role )
+            role.destroy if role.users.empty?
+          end
+        end
+
+        private
+        
+        def get_role( role_name, authorizable_obj )
+          if authorizable_obj.is_a? Class
+            Role.find( :first, 
+                       :conditions => [ 'name = ? and authorizable_type = ? and authorizable_id IS NULL', role_name, authorizable_obj.to_s ] )
+          elsif authorizable_obj
+            Role.find( :first, 
+                       :conditions => [ 'name = ? and authorizable_type = ? and authorizable_id = ?', 
+                                        role_name, authorizable_obj.class.base_class.to_s, authorizable_obj.id ] )
+          else
+            Role.find( :first, 
+                       :conditions => [ 'name = ? and authorizable_type IS NULL and authorizable_id IS NULL', role_name ] )
+          end
+        end
+        
+      end 
+    end
+        
+    module ModelExtensions
+      def self.included( recipient )
+        recipient.extend( ClassMethods )
+      end
+      
+      module ClassMethods
+        def acts_as_authorizable
+          has_many :accepted_roles, :as => :authorizable, :class_name => 'Role'
+          attr_protected :accepted_role_ids
+          
+          def accepts_role?( role_name, user )
+            user.has_role? role_name, self 
+          end
+          
+          def accepts_role( role_name, user )
+            user.has_role role_name, self
+          end
+          
+          def accepts_no_role( role_name, user )
+            user.has_no_role role_name, self
+          end
+          
+          include AuthorizationNext::ObjectRolesTable::ModelExtensions::InstanceMethods
+          include AuthorizationNext::Identity::ModelExtensions::InstanceMethods   # Provides all kinds of dynamic sugar via method_missing
+        end
+      end
+      
+      module InstanceMethods
+        # If roles aren't overriden in model then check roles table
+        def accepts_role?( role_name, user )
+          user.has_role? role_name, self
+        end
+        
+        def accepts_role( role_name, user )
+          user.has_role role_name, self
+        end
+        
+        def accepts_no_role( role_name, user )
+          user.has_no_role role_name, self
+        end
+      end    
+    end
+    
+  end
+end
+

data/lib/authorization_next/publishare/parser.rb

@@ -0,0 +1,210 @@
+module AuthorizationNext
+  module Base
+    
+    VALID_PREPOSITIONS = ['of', 'for', 'in', 'on', 'to', 'at', 'by']
+    BOOLEAN_OPS = ['not', 'or', 'and']
+    VALID_PREPOSITIONS_PATTERN = VALID_PREPOSITIONS.join('|')
+        
+    module EvalParser
+      # Parses and evaluates an authorization expression and returns <tt>true</tt> or <tt>false</tt>.
+      #
+      # The authorization expression is defined by the following grammar:
+      #         <expr> ::= (<expr>) | not <expr> | <term> or <expr> | <term> and <expr> | <term>
+      #         <term> ::= <role> | <role> <preposition> <model>
+      #  <preposition> ::= of | for | in | on | to | at | by
+      #        <model> ::= /:*\w+/
+      #         <role> ::= /\w+/ | /'.*'/
+      #
+      # Instead of doing recursive descent parsing (not so fun when we support nested parentheses, etc),
+      # we let Ruby do the work for us by inserting the appropriate permission calls and using eval.
+      # This would not be a good idea if you were getting authorization expressions from the outside,
+      # so in that case (e.g. somehow letting users literally type in permission expressions) you'd
+      # be better off using the recursive descent parser in Module RecursiveDescentParser.
+      #
+      # We search for parts of our authorization evaluation that match <role> or <role> <preposition> <model>
+      # and we ignore anything terminal in our grammar.
+      #
+      # 1) Replace all <role> <preposition> <model> matches.
+      # 2) Replace all <role> matches that aren't one of our other terminals ('not', 'or', 'and', or preposition)
+      # 3) Eval
+      
+      def parse_authorization_expression( str )
+        if str =~ /[^A-Za-z0-9_:'\(\)\s]/
+          raise AuthorizationExpressionInvalid, "Invalid authorization expression (#{str})"
+          return false
+        end
+        @replacements = []
+        expr = replace_temporarily_role_of_model( str )
+        expr = replace_role( expr )
+        expr = replace_role_of_model( expr )
+        begin
+          instance_eval( expr )
+        rescue
+          raise AuthorizationExpressionInvalid, "Cannot parse authorization (#{str})"
+        end
+      end
+      
+      def replace_temporarily_role_of_model( str )
+        role_regex = '\s*(\'\s*(.+)\s*\'|(\w+))\s+'
+        model_regex = '\s+(:*\w+)'
+        parse_regex = Regexp.new(role_regex + '(' + VALID_PREPOSITIONS.join('|') + ')' + model_regex)
+        str.gsub(parse_regex) do |match|
+          @replacements.push " process_role_of_model('#{$2 || $3}', '#{$5}') "
+          " <#{@replacements.length-1}> "
+        end
+      end
+      
+      def replace_role( str )
+        role_regex = '\s*(\'\s*(.+)\s*\'|([A-Za-z]\w*))\s*'
+        parse_regex = Regexp.new(role_regex)
+        str.gsub(parse_regex) do |match|
+          if BOOLEAN_OPS.include?($3)
+            " #{match} "
+          else
+            " process_role('#{$2 || $3}') "
+          end
+        end
+      end
+      
+      def replace_role_of_model( str )
+        str.gsub(/<(\d+)>/) do |match|
+          @replacements[$1.to_i]
+        end
+      end
+      
+      def process_role_of_model( role_name, model_name )
+        model = get_model( model_name )
+        raise( ModelDoesntImplementRoles, "Model (#{model_name}) doesn't implement #accepts_role?" ) if not model.respond_to? :accepts_role?
+        model.send( :accepts_role?, role_name, @current_user )
+      end
+      
+      def process_role( role_name )
+        return false if @current_user.nil?
+        raise( UserDoesntImplementRoles, "User doesn't implement #has_role?" ) if not @current_user.respond_to? :has_role?
+        @current_user.has_role?( role_name )
+      end
+
+    end
+    
+    # Parses and evaluates an authorization expression and returns <tt>true</tt> or <tt>false</tt>.
+    # This recursive descent parses uses two instance variables:
+    #  @stack --> a stack with the top holding the boolean expression resulting from the parsing
+    #
+    # The authorization expression is defined by the following grammar:
+    #         <expr> ::= (<expr>) | not <expr> | <term> or <expr> | <term> and <expr> | <term>
+    #         <term> ::= <role> | <role> <preposition> <model>
+    #  <preposition> ::= of | for | in | on | to | at | by
+    #        <model> ::= /:*\w+/
+    #         <role> ::= /\w+/ | /'.*'/
+    #
+    # There are really two values we must track:
+    # (1) whether the expression is valid according to the grammar
+    # (2) the evaluated results --> true/false on the permission queries
+    # The first is embedded in the control logic because we want short-circuiting. If an expression
+    # has been parsed and the permission is false, we don't want to try different ways of parsing.
+    # Note that this implementation of a recursive descent parser is meant to be simple
+    # and doesn't allow arbitrary nesting of parentheses. It supports up to 5 levels of nesting.
+    # It also won't handle some types of expressions (A or B) and C, which has to be rewritten as
+    # C and (A or B) so the parenthetical expressions are in the tail.
+    module RecursiveDescentParser
+      
+      OPT_PARENTHESES_PATTERN = '(([^()]|\(([^()]|\(([^()]|\(([^()]|\(([^()]|\(([^()])*\))*\))*\))*\))*\))*)'
+      PARENTHESES_PATTERN = '\(' + OPT_PARENTHESES_PATTERN + '\)'
+      NOT_PATTERN = '^\s*not\s+' + OPT_PARENTHESES_PATTERN + '$'
+      AND_PATTERN = '^\s*' + OPT_PARENTHESES_PATTERN + '\s+and\s+' + OPT_PARENTHESES_PATTERN + '\s*$'
+      OR_PATTERN = '^\s*' + OPT_PARENTHESES_PATTERN + '\s+or\s+' + OPT_PARENTHESES_PATTERN + '\s*$'
+      ROLE_PATTERN = '(\'\s*(.+)\s*\'|(\w+))'
+      MODEL_PATTERN = '(:*\w+)'
+      
+      PARENTHESES_REGEX = Regexp.new('^\s*' + PARENTHESES_PATTERN + '\s*$')
+      NOT_REGEX = Regexp.new(NOT_PATTERN)
+      AND_REGEX = Regexp.new(AND_PATTERN)
+      OR_REGEX = Regexp.new(OR_PATTERN)
+      ROLE_REGEX = Regexp.new('^\s*' + ROLE_PATTERN + '\s*$')
+      ROLE_OF_MODEL_REGEX = Regexp.new('^\s*' + ROLE_PATTERN + '\s+(' + VALID_PREPOSITIONS_PATTERN + ')\s+' + MODEL_PATTERN + '\s*$')
+        
+      def parse_authorization_expression( str )
+        @stack = []       
+        raise AuthorizationExpressionInvalid, "Cannot parse authorization (#{str})" if not parse_expr( str )
+        return @stack.pop
+      end
+      
+      def parse_expr( str )
+        parse_parenthesis( str ) or
+        parse_not( str ) or
+        parse_or( str ) or
+        parse_and( str ) or
+        parse_term( str )
+      end
+      
+      def parse_not( str )
+        if str =~ NOT_REGEX 
+          can_parse = parse_expr( $1 )
+          @stack.push( !@stack.pop ) if can_parse
+        end
+        false
+      end
+      
+      def parse_or( str )
+        if str =~ OR_REGEX
+          can_parse = parse_expr( $1 ) and parse_expr( $8 )
+          @stack.push( @stack.pop | @stack.pop ) if can_parse
+          return can_parse
+        end
+        false
+      end
+      
+      def parse_and( str )
+        if str =~ AND_REGEX
+          can_parse = parse_expr( $1 ) and parse_expr( $8 )
+          @stack.push(@stack.pop & @stack.pop) if can_parse
+          return can_parse
+        end
+        false
+      end
+      
+      # Descend down parenthesis (allow up to 5 levels of nesting)
+      def parse_parenthesis( str )
+        str =~ PARENTHESES_REGEX ? parse_expr( $1 ) : false
+      end
+      
+      def parse_term( str )
+        parse_role_of_model( str ) or
+        parse_role( str )
+      end
+      
+      # Parse <role> of <model>
+      def parse_role_of_model( str )
+        if str =~ ROLE_OF_MODEL_REGEX
+          role_name = $2 || $3
+          model_name = $5          
+          model_obj = get_model( model_name )
+          raise( ModelDoesntImplementRoles, "Model (#{model_name}) doesn't implement #accepts_role?" ) if not model_obj.respond_to? :accepts_role?
+
+          has_permission = model_obj.send( :accepts_role?, role_name, @current_user )
+          @stack.push( has_permission )
+          true
+        else
+          false
+        end
+      end
+      
+      # Parse <role> of the User-like object
+      def parse_role( str )
+        if str =~ ROLE_REGEX
+          role_name = $1
+          if @current_user.nil?
+            @stack.push(false)
+          else
+            raise( UserDoesntImplementRoles, "User doesn't implement #has_role?" ) if not @current_user.respond_to? :has_role?
+            @stack.push( @current_user.has_role?(role_name) )
+          end
+          true 
+        else
+          false
+        end
+      end
+      
+    end
+  end
+end

data/lib/authorization_next/version.rb

@@ -0,0 +1,3 @@
+module AuthorizationNext
+  VERSION = "0.1.0"
+end

metadata

@@ -0,0 +1,102 @@
+--- !ruby/object:Gem::Specification
+name: authorization_next
+version: !ruby/object:Gem::Version
+  version: 0.1.0
+  prerelease: 
+platform: ruby
+authors:
+- Pavan Agrawal
+autorequire: 
+bindir: exe
+cert_chain: []
+date: 2019-05-14 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: bundler
+  requirement: !ruby/object:Gem::Requirement
+    none: false
+    requirements:
+    - - ~>
+      - !ruby/object:Gem::Version
+        version: '1.17'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    none: false
+    requirements:
+    - - ~>
+      - !ruby/object:Gem::Version
+        version: '1.17'
+- !ruby/object:Gem::Dependency
+  name: rake
+  requirement: !ruby/object:Gem::Requirement
+    none: false
+    requirements:
+    - - ~>
+      - !ruby/object:Gem::Version
+        version: '10.0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    none: false
+    requirements:
+    - - ~>
+      - !ruby/object:Gem::Version
+        version: '10.0'
+description: Converted plugin to gem which will work with association as well.
+email:
+- pavan.agrawala@gmail.com
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- .gitignore
+- .idea/.rakeTasks
+- .idea/authorization.iml
+- .idea/inspectionProfiles/Project_Default.xml
+- .idea/misc.xml
+- .idea/modules.xml
+- .idea/vcs.xml
+- .idea/workspace.xml
+- CODE_OF_CONDUCT.md
+- Gemfile
+- Gemfile.lock
+- LICENSE.txt
+- README.md
+- Rakefile
+- authorization.gemspec
+- bin/console
+- bin/setup
+- lib/authorization_next.rb
+- lib/authorization_next/publishare/exceptions.rb
+- lib/authorization_next/publishare/hardwired_roles.rb
+- lib/authorization_next/publishare/identity.rb
+- lib/authorization_next/publishare/object_roles_table.rb
+- lib/authorization_next/publishare/parser.rb
+- lib/authorization_next/version.rb
+homepage: https://github.com/pavanagrawal/authorization_next
+licenses:
+- MIT
+post_install_message: 
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  none: false
+  requirements:
+  - - ! '>='
+    - !ruby/object:Gem::Version
+      version: '0'
+required_rubygems_version: !ruby/object:Gem::Requirement
+  none: false
+  requirements:
+  - - ! '>='
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubyforge_project: 
+rubygems_version: 1.8.23.2
+signing_key: 
+specification_version: 3
+summary: Converted plugin to gem which will work with association as well.
+test_files: []